The Kent District Library says the computer system outage that closed all its branches is due to a “ransomware event.”
The district recently discovered the event, but provided…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2026-04-22 → 2026-04-28 UTC
Choose a report date
Observed events
175
Public claims in the selected week
Data leak indicators
103
58.9% of observed events
Active actors
34
Distinct groups with observed activity
Torrent-linked events
1
Events intersecting with torrent intelligence
What changed this week?
•
Qilin generated the highest visible claim volume this week, representing 22.9% of observed events.
•
58.9% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 11 observed events.
•
5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
1 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.
Coverage snapshot
As of 2026-04-28 UTC.
Leak sites observed this week
34
Leak sites online near report date
1
Threat actor profiles updated this week
3
Countries represented this week
39
Sectors represented this week
70
Top active actors
By observed claim volumeQilin
40 events · 21 leak indicators
DragonForce
16 events · 15 leak indicators
Gentlemen
14 events · 0 leak indicators
INC Ransom
13 events · 10 leak indicators
Eraleignews
9 events · 9 leak indicators
LeakedData
8 events · 3 leak indicators
M3rx
8 events · 0 leak indicators
Coinbase Cartel
7 events · 0 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- M3rx 8 events
- CL0P 1 event
- Meduza Locker 1 event
- Rhysida 1 event
- Trident 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States66
- Qilin15 events · 7 leak indicators
- DragonForce12 events · 11 leak indicators
- INC Ransom9 events · 7 leak indicators
- Akira3 events · 3 leak indicators
- LeakedData3 events · 2 leak indicators
- ShinyHunters3 events · 3 leak indicators
- Chaos2 events · 2 leak indicators
- Insomnia2 events · 2 leak indicators
United Kingdom9
- Qilin4 events · 1 leak indicator
- M3rx2 events · 0 leak indicators
- AiLock1 event · 1 leak indicator
- Brain Cipher1 event · 1 leak indicator
- Trident1 event · 1 leak indicator
Germany8
- LockBit 5.02 events · 2 leak indicators
- Qilin2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- BravoX1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
Australia6
- Qilin2 events · 2 leak indicators
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Kairos1 event · 0 leak indicators
- M3rx1 event · 0 leak indicators
Canada6
- Beast1 event · 0 leak indicators
- M3rx1 event · 0 leak indicators
- Payload1 event · 1 leak indicator
- PEAR1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
- Rhysida1 event · 1 leak indicator
Indonesia4
- Eraleignews1 event · 1 leak indicator
- Everest1 event · 0 leak indicators
- RansomHouse1 event · 0 leak indicators
- World Leaks1 event · 1 leak indicator
Italy4
- Qilin2 events · 2 leak indicators
- INC Ransom1 event · 1 leak indicator
- M3rx1 event · 0 leak indicators
Sweden3
- DragonForce1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction11
- Qilin4 events · 1 leak indicator
- INC Ransom3 events · 3 leak indicators
- Gentlemen2 events · 0 leak indicators
- Brain Cipher1 event · 1 leak indicator
- PEAR1 event · 1 leak indicator
Law Practice9
- LeakedData3 events · 2 leak indicators
- DragonForce2 events · 2 leak indicators
- CL0P1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Payload1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Medical Practice7
- Qilin2 events · 2 leak indicators
- Beast1 event · 0 leak indicators
- Eraleignews1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Insomnia1 event · 1 leak indicator
- M3rx1 event · 0 leak indicators
Retail7
- DragonForce2 events · 2 leak indicators
- BravoX1 event · 1 leak indicator
- Eraleignews1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- LockBit 5.01 event · 1 leak indicator
- M3rx1 event · 0 leak indicators
Financial Services5
- Anubis2 events · 0 leak indicators
- Qilin2 events · 0 leak indicators
- DragonForce1 event · 1 leak indicator
Government Administration5
- Everest1 event · 0 leak indicators
- Gentlemen1 event · 0 leak indicators
- INC Ransom1 event · 0 leak indicators
- Payload1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Hospitals and Health Care5
- Eraleignews1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- LockBit 5.01 event · 1 leak indicator
- NightSpire1 event · 1 leak indicator
- World Leaks1 event · 1 leak indicator
IT Services and IT Consulting5
- Qilin2 events · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- M3rx1 event · 0 leak indicators
- World Leaks1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 42
- 11-50 employees 39
- 1,001-5,000 employees 21
- 201-500 employees 13
- 501-1,000 employees 13
- 2-10 employees 12
Notable actor profile updates
Active actor records only.
New ransom note observed
Exitium
2026-04-27 UTC
Adding newly observed ransom note, shared by ESET research. Thank you!
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Everest | Government Administration | Indonesia | Claim only | 2026-04-28 |
| M3rx | Packaging and Containers Manufacturing | United Kingdom | Claim only | 2026-04-28 |
| M3rx | Technology, Information and Internet | India | Claim only | 2026-04-28 |
| Chaos | Oil and Gas | United States | Data leak | 2026-04-28 |
| Insomnia | Medical Practice | United States | Data leak | 2026-04-28 |
| World Leaks | Media Production | Hungary | Data leak | 2026-04-28 |
| Qilin | Information Technology and Services | United States | Claim only | 2026-04-28 |
| Qilin | IT Services and IT Consulting | United Kingdom | Claim only | 2026-04-28 |
| Qilin | Law Practice | United States | Claim only | 2026-04-28 |
| Qilin | Civil Engineering | Taiwan | Claim only | 2026-04-28 |
| Qilin | Construction | Australia | Data leak | 2026-04-28 |
| Krybit | Paper and Forest Product Manufacturing | Austria | Claim only | 2026-04-28 |
News and research context
Recent articles from the same time window.
But if you didn’t see a red-flag signal during a scan of the network, you’re not alone: Almost 7,500 organizations around the world were hit by ransomware last year—and there are…
Related actor: M3rx
M3rx is a new ransomware name with a leak site, a Tox contact, and a Windows encryptor that is already doing real work.
. It carries an embedded config, writes RECOVERY_NOTES.T…
Generation Development Group Limited (‘GDG’ or ‘Company’) (ASX: GDG), advises that one of its subsidiary companies, Generation Life Limited, is responding to a contained cyber inc…
ITRON, INC. Cybersecurity Incident
2026-04-24
On April 13, 2026, Itron, Inc. (the “Company” or “Itron”) was notified that an unauthorized third party had gained access to certain of its systems.
The Company activated its c…
Related actor: BlackFile
Unit 42 has responded to numerous incidents since February 2026 involving data theft and extortion across various industries. We attribute a specific portion of this financially-m…
Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks - Help Net Security
2026-04-23
The 2026 InsurSec Report from At-Bay, covering more than 100,000 policy years of claims data, documents a 7% year-over-year rise in overall claim frequency and an all-time high av…
Related actor: Kyber
During a March 2026 incident response engagement, Rapid7 recovered two Kyber ransomware payloads deployed in the same environment, one targeting VMware ESXi infrastructure and the…
A private club failed to take all practicable steps to protect the personal data of its members following a ransomware-related data breach that affected more than 9,000 people, th…
Mile Bluff Statement
2026-04-23
Mile Bluff Medical Center in Mauston is currently experiencing system disruptions related to a security event involving data encryption.
Upon detection, Mile Bluff immediately…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.